EP3780484A1 - Procédé de création de clé de travail et de fonctionnement cryptographique et plateforme ainsi que dispositif de service cryptographique - Google Patents

Procédé de création de clé de travail et de fonctionnement cryptographique et plateforme ainsi que dispositif de service cryptographique Download PDF

Info

Publication number
EP3780484A1
EP3780484A1 EP19854452.0A EP19854452A EP3780484A1 EP 3780484 A1 EP3780484 A1 EP 3780484A1 EP 19854452 A EP19854452 A EP 19854452A EP 3780484 A1 EP3780484 A1 EP 3780484A1
Authority
EP
European Patent Office
Prior art keywords
security module
key
target
working
working key
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP19854452.0A
Other languages
German (de)
English (en)
Other versions
EP3780484C0 (fr
EP3780484B1 (fr
EP3780484A4 (fr
Inventor
Shuting XIAO
Xiaodan LIN
Haifeng Fang
Shengcai GU
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Advanced New Technologies Co Ltd
Original Assignee
Advanced New Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Advanced New Technologies Co Ltd filed Critical Advanced New Technologies Co Ltd
Publication of EP3780484A1 publication Critical patent/EP3780484A1/fr
Publication of EP3780484A4 publication Critical patent/EP3780484A4/fr
Application granted granted Critical
Publication of EP3780484C0 publication Critical patent/EP3780484C0/fr
Publication of EP3780484B1 publication Critical patent/EP3780484B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/602—Providing cryptographic facilities or services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0822—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using key encryption key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0825—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0819—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s)
    • H04L9/0827—Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) involving distinctive intermediate devices or communication paths
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/062—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00 applying encryption of the keys

Definitions

  • This specification relates to the field of cryptographic technology, in particular to a cryptographic operation method, a method for creating a working key, a cryptographic service platform, and a cryptographic service device.
  • Cryptographic technology is an important technical means to protect business systems such as banks, securities, or transactions to ensure data confidentiality, integrity, non-repudiation, and availability in data storage, transmission, and access control.
  • an enterprise can configure a cryptographic service platform.
  • the cryptographic service platform is a system platform that provides key management and cryptographic operation services based on security modules.
  • the platform serving as a server of a business system, can provide application layer cryptographic services such as message verification, data encryption and decryption, and signature verification for the business system, ensure the security of data in the process of storage, transmission, and application, and prevent data from being stolen or maliciously tampered with. How to provide a more stable cryptographic service platform has become an urgent technical problem to be solved.
  • this specification provides a cryptographic operation method, a method for creating a working key, a cryptographic service platform, and a cryptographic service device.
  • a cryptographic service platform is provided, the cryptographic service platform is connected to a primary security module and at least one secondary security module, and the security modules has master keys; and the cryptographic service platform includes:
  • the registration module is further configured to: obtain target private key indication data encrypted by the master key of the secondary security module; and when the secondary security module is called by the working key creation module, still take the target private key indication data as input for the secondary security module to obtain a target private key by using the master key to decrypt and then decrypt the input working key ciphertext.
  • the target private key indication data encrypted by the master key of the secondary security module includes: a target private key ciphertext generated by encrypting the target private key with the master key of the secondary security module, or a target private key identifier encrypted with the master key of the secondary security module.
  • the registration module is further configured to:
  • a cryptographic operation method including:
  • the target private key stored by the registration module is encrypted with the master key of the secondary security module.
  • the method further includes: obtaining target private key indication data encrypted by the master key of the secondary security module; and when the secondary security module is called, still taking the target private key indication data as input, for the secondary security module to obtain a target private key by using the master key to decrypt and then decrypt the input working key ciphertext.
  • the target private key indication data encrypted by the master key of the secondary security module includes: a target private key ciphertext generated by encrypting the target private key with the master key of the secondary security module, or a target private key identifier encrypted with the master key of the secondary security module.
  • the method further includes:
  • a cryptographic service device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when executing the program:
  • a method for creating a working key including:
  • a cryptographic service device including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when executing the program:
  • one of the security modules connected to the cryptographic service platform serves as the primary security module, and the key management function of the cryptographic service platform is provided by the primary security module.
  • the primary security module is configured to generate the working key, and both the primary security module and secondary security modules can provide the cryptographic operation function required by the cryptographic service platform.
  • Each security module independently generates its own master key, the working key of the business system is generated by the primary security module, and the cryptographic service platform stores the working key ciphertext encrypted by the master key of the primary security module and the working key ciphertext encrypted separately by the master key of each secondary security module. Therefore, in this embodiment, the master key is stored by the primary security module, the plaintext of the sensitive security parameters will not exceed the boundary of the security module, the key security will not be lost, and therefore, the security requirements of the key are met.
  • the cryptographic service platform can call any security module to respond to the cryptographic operation request of the business system. Therefore, the cryptographic service platform is compatible with multiple types of security modules, such that the cryptographic service platform will not be bound by a single security module manufacturer, the requirements of using multiple types of security modules are satisfied, and the cryptographic service platform can provide a more stable cryptographic service.
  • first, second, third, etc. may be used to describe various information in this specification, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as the first information.
  • word "if” as used herein may be interpreted as "at the time of' or "when” or "in response to determination.”
  • FIG. 1 it is an application scenario diagram of a cryptographic service platform according to an example embodiment of this specification.
  • the cryptographic service platform communicates with an application system host, and the application system host calls an interface provided by the cryptographic service platform to use a cryptographic service, and underlying cryptographic operation and other services are completed through calling, by the cryptographic service platform, a security module.
  • a security module contains cryptographic algorithms and security functions, is relatively independent software, hardware, firmware, or a combination thereof that can implement a key management mechanism, and is contained within a cryptographic boundary.
  • the cryptographic boundary refers to a clearly defined continuous edge that establishes the physical and/or logical boundaries of the security module and includes all hardware, software, and/or firmware components of the security module.
  • the cryptographic service platform in the embodiments of this specification is built based on multiple types of security modules, so the cryptographic service platform is connected with multiple types of security modules.
  • the cryptographic service platform is connected with multiple types of security modules.
  • one of the security modules connected to the cryptographic service platform serves as a primary security module, and the key management function of the cryptographic service platform is mainly provided by the primary security module.
  • the security modules other than the primary security module are referred to as secondary security modules in the embodiment of this specification, which can provide the cryptographic operation function required by the cryptographic service platform.
  • Each security module independently generates its own master key, a working key of the business system is generated by the primary security module, and the cryptographic service platform stores a working key ciphertext encrypted by the master key of the primary security module and a working key ciphertext encrypted separately by the master key of each secondary security module.
  • the master keys are stored by respective security modules, and the plaintext of the keys as a sensitive security parameter will not exceed the boundaries of the security modules, so the security requirements of the keys are met, and the security of the keys will not be lost.
  • the cryptographic service platform can call any security module to respond to a cryptographic operation request of the business system. Therefore, the cryptographic service platform is compatible with multiple types of security modules, such that the cryptographic service platform will not be bound by a single security module manufacturer, the requirements of using multiple types of security modules are satisfied, and the cryptographic service platform can provide a more stable cryptographic service.
  • the cryptographic service platform of the embodiment of this specification may include a registration module 21, a working key creation module 22, and a cryptographic operation calling module 23, which are respectively configured to register a secondary security module, create the working key of the business system, and call a security module to respond to the cryptographic operation request of the business system.
  • the registration module is configured to: call the secondary security module to generate an asymmetric key pair including a target public key and a target private key, and obtain and then store the target public key returned by the secondary security module;
  • the working key creation module is configured to: receive a working key creation request of the business system, and with the target public key of the secondary security module as input, call the primary security module to generate the working key for the business system, and obtain the following returned by the primary security module: a working key ciphertext encrypted by the master key of the primary security module, and a working key ciphertext encrypted by the target public key of the secondary security module; with the working key ciphertext encrypted by the target public key of the secondary security module as input, call the secondary security module to obtain the following returned by the secondary security module: a working key ciphertext encrypted by its own master key after decrypting the input working key ciphertext with the target private key; and
  • the cryptographic operation calling module is configured to: receive a cryptographic operation request of the business system, the cryptographic operation request carrying data to be operated; determine a target security module responding to the cryptographic operation request; and with a working key ciphertext corresponding to the target security module and the data to be operated as input, call the target security module to obtain an operation result of the target security module, the operation result being obtained in a way that the target security module uses the stored master key to decrypt the working key ciphertext to obtain a working key, and then the data to be operated is encrypted with the working key obtained by decryption.
  • a security module needs to set a master key for work before working, and the security module uses the master key to encrypt a key to be protected.
  • the security module itself will have a key derivation algorithm to generate the key.
  • each security module generates its own master key. Due to the subsequent working key creation process of the business system, in this embodiment, the secondary security module is required to generate an asymmetric key pair including the target public key and the target private key during registration, and at least provide it to the cryptographic service platform to save the target public key, such that the cryptographic service platform can safely transmit and save data when the primary security module creates the working key subsequently.
  • a key generation service interface of the secondary security module is called, the secondary security module generates the asymmetric key pair including the target public key and the target private key, and the cryptographic service platform obtains and then stores the target public key returned by the secondary security module.
  • the purpose of the target public key is that after the primary security module creates the working key, the working key can be encrypted with the target public key and then securely transmitted to the secondary security module (this process will be described in detail later).
  • the secondary security module may also use target private key indication data encrypted by the master key, and the indication data is used to correspond to the target private key; the target private key indication data can be provided to the cryptographic service platform, such that when the secondary security module needs to use the target private key later, the cryptographic service platform can transmit the target private key indication data to the secondary security module for the secondary security module to determine which private key should be obtained for subsequent process.
  • the target private key indication data encrypted by the master key of the secondary security module may include: a target private key ciphertext generated by encrypting the target private key with the master key of the secondary security module, or a target private key identifier encrypted with the master key of the secondary security module.
  • the cryptographic service platform may also take the target public key of the secondary security module as input to call the primary security module, the primary security module authenticates the target public key and obtains a key check value obtained through performing, by the primary security module, message authentication code value calculation on the target public key, and the key check value is used for subsequent checking of the primary security module to prevent data from being tampered with.
  • FIG. 2B it is a registration process of the secondary security module according to an example embodiment of this specification.
  • the working key refers to a key created for the business system through which the security module provides a cryptographic operation function for the business system.
  • the process of creating the working key may be:
  • this embodiment may use the asymmetric key pair as the target key. Therefore, in this stage, the corresponding example is as follows, as shown in FIG. 2C , it is a process of creating the working key according to an example embodiment of this specification.
  • the cryptographic service platform After the execution is completed, the cryptographic service platform records multiple working key ciphertexts: contents of the ciphertext encrypted by the master key of the primary security module and ciphertexts encrypted by the master keys of various secondary security modules.
  • the cryptographic service platform provides the cryptographic operation service to the business system.
  • the cryptographic service platform can receive the cryptographic operation request from the business system, and the cryptographic operation request carries data to be operated.
  • the cryptographic service platform may provide services for multiple business systems, and each business system may also correspond to multiple working keys. Therefore, the cryptographic operation request also carries a key identifier for the cryptographic service platform to determine which working key should be used to provide cryptographic operation service.
  • the cryptographic service platform can select any one of the security modules to respond to the cryptographic operation request.
  • the security module selected by the cryptographic service platform is referred to as a target security module.
  • the selection mode of the cryptographic service platform can be flexibly configured according to needs, for example, based on the current processing capability of each security module, the number of tasks being processed, and the like.
  • the cryptographic service platform can obtain the working key ciphertext corresponding to the target security module from the stored multiple working key ciphertexts.
  • the cryptographic service platform can take the working key ciphertext as input to call the target security module.
  • the target security module can decrypt the working key ciphertext by using the stored own master key to obtain the working key, and then use the working key to perform operation on the data to be operated, and the operation result can be returned to the cryptographic service platform and returned by the cryptographic service platform to the business system.
  • FIG. 2D it is a schematic diagram of cryptographic operation according to an example embodiment of this specification.
  • this specification also provides the embodiments of the cryptographic operation method and the computer device to which the cryptographic service platform is applied.
  • the embodiment of the cryptographic service platform in this specification can be applied to the computer device, such as a server.
  • the apparatus embodiments may be implemented by software, or by hardware or a combination of hardware and software. Taking software implementation as an example, as an apparatus in a logical sense, it is formed by reading corresponding computer program instructions in a non-volatile memory into a memory to run through the processor where it is located. From a hardware perspective, as shown in FIG. 3 , it is a hardware structure diagram of a computer device where a cryptographic service platform is located according to an embodiment of this specification.
  • the server where cryptographic service platform 331 is located in the embodiment may generally further include other hardware according to actual functions of the computer device, which will not be repeated here.
  • FIG. 4 is a flowchart of a cryptographic operation method according to an example embodiment of this specification, which includes the following steps:
  • the target private key stored by the registration module is encrypted with the master key of the secondary security module.
  • the method further includes: obtaining target private key indication data encrypted by the master key of the secondary security module; and when the secondary security module is called, still taking the target private key indication data as input, for the secondary security module to obtain a target private key by using the master key to decrypt and decrypt the input working key ciphertext.
  • the target private key indication data encrypted by the master key of the secondary security module includes: the target private key ciphertext from encryption of the target private key with the master key of the secondary security module, or the target private key identifier encrypted by the master key of the secondary security module.
  • the method further includes:
  • FIG. 5 is a method for creating a working key according to an example embodiment of this specification, which includes:
  • one of the security modules connected to the cryptographic service platform serves as the primary security module, and the key management function of the cryptographic service platform is provided by the primary security module.
  • the primary security module is configured to generate the working key, and both the primary security module and secondary security modules can provide the cryptographic operation function required by the cryptographic service platform.
  • Each security module independently generates its own master key, the working key of the business system is generated by the primary security module, and the cryptographic service platform stores the working key ciphertext encrypted by the master key of the primary security module and the working key ciphertext encrypted separately by the master key of each secondary security module. Therefore, in this embodiment, the master key is stored by the primary security module, the plaintext of the sensitive security parameters will not exceed the boundaries of the security modules, the key security will not be lost, and therefore, the security requirements of the keys are met.
  • the embodiment of this specification also provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when executing the program:
  • the embodiment of this specification also provides a cryptographic service device, including a memory, a processor, and a computer program stored on the memory and executable on the processor, wherein the processor implements the following method when executing the program:
  • the description of parts of the method embodiment can be referred to for relevant parts.
  • the apparatus embodiment described above is only schematic, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, may be located in one place, or may be distributed to multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the objectives of the solution in this specification. Those of ordinary skill in the art can understand and implement without paying creative labor.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Sub-Exchange Stations And Push- Button Telephones (AREA)
EP19854452.0A 2018-08-31 2019-07-17 Procédé de création de clé de travail et de fonctionnement cryptographique et plateforme ainsi que dispositif de service cryptographique Active EP3780484B1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811010286.6A CN109347625B (zh) 2018-08-31 2018-08-31 密码运算、创建工作密钥的方法、密码服务平台及设备
PCT/CN2019/096309 WO2020042798A1 (fr) 2018-08-31 2019-07-17 Procédé de création de clé de travail et de fonctionnement cryptographique et plateforme ainsi que dispositif de service cryptographique

Publications (4)

Publication Number Publication Date
EP3780484A1 true EP3780484A1 (fr) 2021-02-17
EP3780484A4 EP3780484A4 (fr) 2021-09-29
EP3780484C0 EP3780484C0 (fr) 2023-06-07
EP3780484B1 EP3780484B1 (fr) 2023-06-07

Family

ID=65292127

Family Applications (1)

Application Number Title Priority Date Filing Date
EP19854452.0A Active EP3780484B1 (fr) 2018-08-31 2019-07-17 Procédé de création de clé de travail et de fonctionnement cryptographique et plateforme ainsi que dispositif de service cryptographique

Country Status (6)

Country Link
US (1) US11025415B2 (fr)
EP (1) EP3780484B1 (fr)
CN (1) CN109347625B (fr)
SG (1) SG11202010745XA (fr)
TW (1) TWI706658B (fr)
WO (1) WO2020042798A1 (fr)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109347625B (zh) * 2018-08-31 2020-04-24 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备
CN110166234A (zh) * 2019-05-21 2019-08-23 阿里巴巴集团控股有限公司 一种业务密钥创建与业务数据加密方法、装置及系统
CN111541723B (zh) * 2020-07-07 2020-10-13 飞天诚信科技股份有限公司 一种处理密钥数据的方法和终端
CN111935181B (zh) * 2020-09-25 2021-01-26 北京天御云安科技有限公司 一种全密态条件下密钥切换的业务无中断实现方法
CN112788005B (zh) * 2020-12-29 2023-05-23 福建正孚软件有限公司 一种软硬件结合的提高安全性的跨境传输方法和系统
CN114629642A (zh) * 2022-03-17 2022-06-14 浙江大华技术股份有限公司 目标数据的发送方法、装置、存储介质及电子装置
CN115801453B (zh) * 2023-01-30 2023-05-02 北京大数元科技发展有限公司 一种敏感数据互联网安全查询的系统
CN116232593B (zh) * 2023-05-05 2023-08-25 杭州海康威视数字技术股份有限公司 多密码模组敏感数据分类分级与保护方法、设备及系统

Family Cites Families (22)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7711122B2 (en) * 2001-03-09 2010-05-04 Arcot Systems, Inc. Method and apparatus for cryptographic key storage wherein key servers are authenticated by possession and secure distribution of stored keys
WO2005119606A1 (fr) * 2004-05-28 2005-12-15 International Business Machines Corporation Systeme de transfert de donnees au moyen d'une carte intelligente et methodes pour assurer la securite du stockage et de la transmission
JP5018558B2 (ja) * 2008-02-29 2012-09-05 富士通株式会社 記憶領域割当方法および情報処理装置
US20090296926A1 (en) * 2008-06-02 2009-12-03 Sun Microsystems, Inc. Key management using derived keys
GB2471282B (en) * 2009-06-22 2015-02-18 Barclays Bank Plc Method and system for provision of cryptographic services
CN101656007B (zh) * 2009-08-14 2011-02-16 通联支付网络服务股份有限公司 一种在pos机上实现一机多密的安全系统及方法
CN102355351B (zh) * 2011-07-21 2014-11-05 华为技术有限公司 一种基于可信计算的密钥生成、备份和迁移方法及系统
US9350536B2 (en) * 2012-08-16 2016-05-24 Digicert, Inc. Cloud key management system
CN102957541B (zh) * 2012-11-21 2016-11-16 浪潮集团有限公司 一种基于saas的密码加密方法
CN103237005A (zh) * 2013-03-15 2013-08-07 福建联迪商用设备有限公司 密钥管理方法及系统
CN103714636B (zh) * 2013-03-15 2015-12-02 福建联迪商用设备有限公司 一种批量采集和上传传输密钥tk数据的方法及操作终端
CN103825698A (zh) * 2014-01-20 2014-05-28 中国建设银行股份有限公司 一种密码安全管理系统和方法
GB201519612D0 (en) * 2015-11-06 2015-12-23 Nagravision Sa Key sequence generation for cryptographic operations
US9379890B1 (en) * 2015-12-07 2016-06-28 Workiva Inc. System and method for managing cryptographic keys
CN106059760B (zh) * 2016-07-12 2019-03-19 武汉理工大学 一种从用户端密码模块调用系统私钥的密码系统
CN106452771B (zh) * 2016-10-10 2018-09-18 山东渔翁信息技术股份有限公司 Jce调用密码卡实现内置rsa密钥运算的方法及装置
US10230525B2 (en) * 2016-12-23 2019-03-12 Amazon Technologies, Inc. Public key rollup for merkle tree signature scheme
CN107070642B (zh) * 2016-12-26 2020-07-21 贵州银行股份有限公司 多品牌密码机异构资源池复用技术
CN108123800B (zh) * 2017-12-19 2021-06-15 腾讯科技（深圳）有限公司 密钥管理方法、装置、计算机设备及存储介质
CN108365950A (zh) * 2018-01-03 2018-08-03 深圳怡化电脑股份有限公司 金融自助设备密钥的生成方法及装置
CN109067528B (zh) * 2018-08-31 2020-05-12 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备
CN109347625B (zh) * 2018-08-31 2020-04-24 阿里巴巴集团控股有限公司 密码运算、创建工作密钥的方法、密码服务平台及设备

Also Published As

Publication number Publication date
CN109347625B (zh) 2020-04-24
TWI706658B (zh) 2020-10-01
US11025415B2 (en) 2021-06-01
SG11202010745XA (en) 2020-11-27
CN109347625A (zh) 2019-02-15
TW202011712A (zh) 2020-03-16
EP3780484C0 (fr) 2023-06-07
EP3780484B1 (fr) 2023-06-07
WO2020042798A1 (fr) 2020-03-05
US20210067326A1 (en) 2021-03-04
EP3780484A4 (fr) 2021-09-29

Similar Documents

Publication Publication Date Title
US11025415B2 (en) Cryptographic operation method, method for creating working key, cryptographic service platform, and cryptographic service device
CN109067528B (zh) 密码运算、创建工作密钥的方法、密码服务平台及设备
EP3937424B1 (fr) Méthodes et appareils de traitement des données de la blockchain basés sur le cloud computing
CN110580418B (zh) 基于区块链账户的隐私数据查询方法及装置
CN110580262B (zh) 基于智能合约的隐私数据查询方法及装置
CN111475829A (zh) 基于区块链账户的隐私数据查询方法及装置
CN110580412B (zh) 基于链代码的权限查询配置方法及装置
US8495383B2 (en) Method for the secure storing of program state data in an electronic device
JP2009087035A (ja) 暗号クライアント装置、暗号パッケージ配信システム、暗号コンテナ配信システム、暗号管理サーバ装置、ソフトウェアモジュール管理装置、ソフトウェアモジュール管理プログラム
US10700865B1 (en) System and method for granting secure access to computing services hidden in trusted computing environments to an unsecure requestor
CN107948212A (zh) 一种日志的处理方法及装置
US11516194B2 (en) Apparatus and method for in-vehicle network communication
US20240184909A1 (en) Data security processing method and apparatus
WO2024139273A1 (fr) Procédé et appareil d'apprentissage fédéré, support de stockage lisible et dispositif électronique
CN114448648A (zh) 基于rpa的敏感凭据管理方法及系统
CN111859379A (zh) 保护数据模型的处理方法和装置
EP3836478A1 (fr) Procede et systeme pour cryptage des donnees en utilisent des clés cryptographiques
CN115766064A (zh) 一种密码应用方法、装置、设备及存储介质
JP5483754B2 (ja) ソフトウェアモジュール管理装置およびソフトウェアモジュール管理プログラム
CN111859378A (zh) 保护数据模型的处理方法和装置
CN114978490A (zh) 隐私数据的加密方法及装置、处理器和电子设备

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20201030

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

A4 Supplementary search report drawn up and despatched

Effective date: 20210826

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 9/32 20060101ALI20210820BHEP

Ipc: H04L 29/06 20060101ALI20210820BHEP

Ipc: H04L 9/08 20060101AFI20210820BHEP

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20220531

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 9/08 20060101AFI20221114BHEP

INTG Intention to grant announced

Effective date: 20221209

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

Ref country code: AT

Ref legal event code: REF

Ref document number: 1578030

Country of ref document: AT

Kind code of ref document: T

Effective date: 20230615

Ref country code: DE

Ref legal event code: R096

Ref document number: 602019030749

Country of ref document: DE

U01 Request for unitary effect filed

Effective date: 20230707

U07 Unitary effect registered

Designated state(s): AT BE BG DE DK EE FI FR IT LT LU LV MT NL PT SE SI

Effective date: 20230720

U20 Renewal fee paid [unitary effect]

Year of fee payment: 5

Effective date: 20230727

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230907

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230908

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231007

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231007

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602019030749

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230607

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230731

26N No opposition filed

Effective date: 20240308

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20230907

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230717

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230907

U20 Renewal fee paid [unitary effect]

Year of fee payment: 6

Effective date: 20240605

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230717

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230907